authenticated username in accessError.html

[Cantor, Scott]

On 8/24/11 6:24 AM, "Chris Franks" <chris.franks at newcastle.ac.uk> wrote:
>
>I'm creating custom error pages (for sessionError and accessError) on our
>SPs and would like to know if there's any way that the userid (or
>REMOTE_USER as defined in the application defaults) can be passed through
>using a shibmlp tag?  Or would redirection to a protected (valid-user)
>resource on the same SP be an advised way of achieving this?

It's very unlikely in the sessionError case that a session would exist,
and redirecting to a protected page is just going loop as a result.

>Just "<username> does not have access..." reads better and would be
>easier to analyse than "you do not have access" (especially where users
>may have already authenticated with role/secondary accounts).

For access errors, I would advise using the web server to customize the
403 response directly and simply omit the use of the template entirely.
Redirection would be an alternative.

In terms of your technical question, I'll have to take a look, I wrote
that code many years ago now and I don't remember exactly what it has
access to. I know you can add arbitrary properties to the Errors element
and plug those in, but I don't think it has access to the session if one
exists.

-- Scott